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RECEIVED 
CENTRAL FAX CENTER 

AMENDMENTS TO THE CLAIMS: N0V 1 0 2008 

, This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

LISTING OF CLAIMS 



1 . (Currently Amended) A method for detecting a substring of interest from a 
plurality of datagrams that arrives out-of-order, comprising: 

receiving a datagram, the datagram comprising a body substring and a 
header with an index; 

determining whether a preceding span exists in a span set; 

determining whether a succeeding span exists in said span set; and 

applying an automaton having a list of substrings of interest to the body 
substring of said datagram to determine whether contents of said body substring 
match e s match one of said substrings of interest 

2. (Previously Presented) The method of claim 1, wherein if said preceding 
span and said succeeding span do not exist, then said body substring is inserted 
into said span set. 

3. (Previously Presented) The method of claim 1, wherein if said succeeding 
span does exist, then said body substring is joined with said succeeding span to 
produce a join span. 

4. (Original) The method of claim 3, wherein said succeeding span is 
replaced by said join span. 



5. (Previously Presented) The method of claim 1 , wherein if said preceding 
span does exist, then said preceding span is joined with said body substring to 
produce a join span. 
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6. (Original) The method of claim 5, wherein said preceding span is replaced 
by said join span. 

7. (Previously Presented) The method of claim 1 , wherein if said preceding 
span and said succeeding span do exist, then said preceding span is joined with 
said body substring to produce a join span. 

8. (Original) The method of claim 7, wherein said join span is joined with 
said succeeding span to produce a second join span. 

9. (Original) The method of claim 8, wherein said preceding span and said 
succeeding span are replaced by said second join span. 

10. (Previously Presented) The method of claim 1, wherein said body 
substring is forwarded, while parameters of said body substring are stored. 

1 1 . (Previously Presented) The method of claim 10, wherein said parameters 
comprise at least one of: a state of said automaton, said index, a length of the 
body substring, and a prefix. 

12. (Original) The method of claim 1, wherein said method for detecting a 
substring of interest is performed as a network monitoring function. 

13. (Original) The method of claim 1, wherein said method for detecting a 
substring of interest is performed as an intrusion detection function. 

14. (Original) The method of claim 1, wherein said method for detecting a 
substring of interest is performed as a firewall function. 

15. (Original) The method of claim 1, wherein said method for detecting a 
substring of interest is performed as a routing function. 
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16. (Original) The method of claim 1, wherein said method for detecting a 
substring of interest is performed as a toad balancing function. 

17. (Original) The method of claim 1, wherein said method for detecting a 
substring of interest is performed as an anti-virus filtering function. 

18. (Original) The method of claim 1, wherein said method for detecting a 
substring of interest is performed as an anti-spam filtering function. 

19. (Original) The method of claim 1, wherein said method for detecting a 
substring of interest is performed as a document control function. 

20. (Original) The method of claim 1, wherein said method for detecting a 
substring of interest is performed as a web content filtering function. 

21. (Original) The method of claim 1, wherein said method for detecting a 
substring of interest is performed as a virtual private network monitoring function. 

22. (Original) The method of claim 1, wherein said method for detecting a 
substring of interest is performed as a storage area network security function. 

23. (Previously Presented) The method of claim 10, further comprising: 
determining whether said body substring is subsequently dropped by a 

target machine. 

24. (Previously Presented) The method of claim 23, wherein if said body 
substring is subsequently dropped, then a connection for passing said body 
substring is reset. 

25. (Original) The method of claim 24, wherein said connection is a TCP 
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connection. 

26. (Currently Amended) An apparatus for detecting a substring of interest 
from a plurality of datagrams that arrives out-of-order, comprising: 

means for receiving a datagram, the datagram comprising a body 
substring and a header with an index; 

means for determining whether a preceding span exists in a span set; 
means for determining whether a succeeding span exists in said span set; 

and 

means for applying an automaton having a list of substrings of interest to 
the body substring of said datagram to determine whether contents of said body 
substring match e s match one of said substrings of interest. 

27. (Previously Presented) The apparatus of claim 26, wherein if said 
preceding span and said succeeding span do not exist, then said body substring 
is inserted into said span set. 

28. (Previously Presented) The apparatus of claim 26, wherein if said 
succeeding span does exist, then said body substring is joined with said 
succeeding span to produce a join span. 

29. (Original) The apparatus of claim 28, wherein said succeeding span is 
replaced by said join span. 

30. (Previously Presented) The apparatus of claim 26, wherein if said 
preceding span does exist, then said preceding span is joined with said body 
substring to produce a join span. 

31. (Original) The apparatus of claim 30, wherein said preceding span is 
replaced by said join span. 
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32. (Previously Presented) The apparatus of claim 26, wherein if said 
preceding span and said succeeding span do exist, then said preceding span is 
joined with said body substring to produce a join span. 

33. (Original) The apparatus of claim 32, wherein said join span is joined with 
said succeeding span to produce a second join span. 

34. (Original) The apparatus of claim 33, wherein said preceding span and 
said succeeding span are replaced by said second join span. 

35. (Previously Presented) The apparatus of claim 26, wherein said body 
substring is forwarded, while parameters of said body substring are stored. 

36. (Previously Presented) The apparatus of claim 35, wherein said 
parameters comprise at least one of: a state of said automaton, said index, a 
length of the body substring, and a prefix. 

37. (Original) The apparatus of claim 26, wherein said apparatus is a network 
monitor. 

38. (Original) The apparatus of claim 26, wherein said apparatus an intrusion 
detector. 

39. (Original) The apparatus of claim 26, wherein said apparatus is a firewall. 

40. (Original) The apparatus of claim 26, wherein said apparatus is a router. 

41. (Original) The apparatus of claim 26, wherein said apparatus is a load 
balancer. 

42. (Original) The apparatus of claim 26, wherein said apparatus is an anti- 
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virus filter. 

43. (Original) The apparatus of claim 26, wherein said apparatus is an anti- 
spam filter. 

44. (Original) The apparatus of claim 26, wherein said apparatus is a 
document controller. 

45. (Original) The apparatus of claim 26, wherein said apparatus is a web 
content filter. 

46. (Original) The apparatus of claim 26, wherein said apparatus is a virtual 
private network monitor. 

47. (Original) The apparatus of claim 26, wherein said apparatus is a storage 
area network security device. 

48. (Previously Presented) The apparatus of claim 35, further comprising: 
means for determining whether said body substring is subsequently 

dropped by a target machine. 

49. (Previously Presented) The apparatus of claim 48, wherein if said body is 
subsequently dropped, then a connection for passing said body is reset. 

50. (Original) The apparatus of claim 49, wherein said connection is a TCP 
connection. 

51 . (Currently Amended) A computer-readable medium having stored thereon 
a plurality of instructions, the plurality of instructions including instructions which, 
when executed by a processor, cause the processor to perform the steps of a 
method for detecting a substring of interest from a plurality of datagrams that 
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arrives out-of-order, comprising of: 

receiving a datagram, the datagram comprising a body substring and a 
header with an index; 

determining whether a preceding span exists in a span set; 

determining whether a succeeding span exists in said span set; and 

applying an automaton having a list of substrings of interest to the body 
substring of said datagram to determine whether contents of said body substring 
matohoo match one of said substrings of interest. 

52. (Previously Presented) The computer-readable medium of claim 51 , 
wherein if said preceding span and said succeeding span do not exist, then said 
body substring is inserted into said span set. 

53. (Previously Presented) The computer-readable medium of claim 51, 
wherein if said succeeding span does exist, then said body substring is joined 
with said succeeding span to produce a join span. 

54. (Original) The computer-readable medium of claim 53, wherein said 
succeeding span is replaced by said join span. 

55. (Previously Presented) The computer-readable medium of claim 51, 
wherein if said preceding span does exist, then said preceding span is joined 
with said body substring to produce a join span. 

56. (Original) The computer-readable medium of claim 55, wherein said 
preceding span is replaced by said join span. 

57. (Previously Presented) The computer-readable medium of claim 51, 
wherein if said preceding span and said succeeding span do exist, then said 
preceding span is joined with said body substring to produce a join span. 
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58. (Original) The computer-readable medium of claim 57, wherein said join 
span is joined with said succeeding span to produce a second join span. 

59. (Original) The computer-readable medium of claim 58, wherein said 
preceding span and said succeeding span are replaced by said second join 
span. 

60. (Previously Presented) The computer-readable medium of claim 51, 
wherein said body substring is forwarded, while parameters of said body 
substring are stored. 

61. (Previously Presented) The computer-readable medium of claim 50, 
wherein said parameters comprise at least one of: a state of said automaton, 
said index, a length of the body substring, and a prefix. 

62. (Previously Presented) The computer-readable medium of claim 50, 
further comprising: 

determining whether said body substring is subsequently dropped by a 
target machine. 

63. (Previously Presented) The computer-readable medium of claim 62, 
wherein if said body substring is subsequently dropped, then a connection for 
passing said body substring is reset. 

64. (Original) The computer-readable medium of claim 63, wherein said 
connection is a TCP connection. 
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